Maya Protocol loses $1.7M as six-bug exploit exposes DeFi security gaps

Maya Protocol fell victim to a hacker this week who exploited a flaw that points to a bigger issue, namely, that tools for defense have issues keeping up with sophisticated hacks. Blockchain security firm CertiK has estimated that the total direct loss was about $1.7 million as the hacker deceived Maya into awarding a nonexistent subsidy and then repeatedly added and removed liquidity to extract assets from shared pools.

The aftermath of the attack hit Maya’s liquidity providers and CACAO holders straightaway. What is more important is that the vulnerabilities were not just the direct result of a broken line of code. It took advantage of regular protocol logic behaving differently than what was expected of it, making this type of attack undetectable until it was already too late to stop it.

How the attacker gamed Maya’s accounting

According to CertiK, which identified the event on August 19, the hacker caused a misrepresentation of Maya’s internal accounting through a fake subsidy, only to finally alter liquidity positions to withdraw an estimated 48.87 million CACAO and 98.82 LINK. DefiLlama Hacks and Exploits Database classified the August 18 occurrence as “Protocol Logic,” attributing a loss of $1.7 million.

… Continue reading the full article at the original source below.